乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-04-18： 细节已通知厂商并且等待厂商处理中 2016-04-20： 厂商已经确认，细节仅向厂商公开 2016-04-30： 细节向核心白帽子及相关领域专家公开 2016-05-10： 细节向普通白帽子公开 2016-05-20： 细节向实习白帽子公开 2016-06-04： 细节向公众公开
泛华企业集团整站数据库+WEB文件泄露
网站http://www.cninsure.net漏洞服务器ftp://219.141.188.8数据库备份ftp://219.141.188.8/data/
/data/ 的索引名称 大小 修改日期[上级目录] FHInsurance_backup_200908012300.bak 80.1 MB 09/8/1 下午11:00:00FHInsurance_backup_200909012300.bak 81.1 MB 09/9/1 下午11:00:00FHInsurance_backup_200910012300.bak 82.1 MB 09/10/1 下午11:00:00FHInsurance_backup_200911012300.bak 83.1 MB 09/11/1 下午11:00:00FHInsurance_backup_200912012300.bak 84.1 MB 09/12/1 下午11:00:00FHInsurance_backup_201001012300.bak 85.1 MB 10/1/1 下午11:00:00FHInsurance_backup_201002012300.bak 85.1 MB 10/2/1 下午11:00:00FHInsurance_backup_201003012300.bak 85.1 MB 10/3/1 下午11:00:00FHInsurance_backup_201004012300.bak 86.1 MB 10/4/1 下午11:00:00FHInsurance_backup_201005012300.bak 87.1 MB 10/5/1 下午11:00:00FHInsurance_backup_201006012300.bak 88.1 MB 10/6/1 下午11:00:00FHInsurance_backup_201007012300.bak 89.1 MB 10/7/1 下午11:00:00FHInsurance_backup_201008012300.bak 89.1 MB 10/8/1 下午11:00:00FHInsurance_backup_201008102300.bak 89.1 MB 10/8/10 下午11:00:00FHInsurance_backup_201010112300.bak 91.1 MB 10/10/11 下午11:00:00FHInsurance_backup_201010122300.bak 91.1 MB 10/10/12 下午11:00:00FHInsurance_backup_201010162300.bak 91.1 MB 10/10/16 下午11:00:00FHInsurance_backup_201010232300.bak 91.1 MB 10/10/23 下午11:00:00FHInsurance_backup_201010302300.bak 91.1 MB 10/10/30 下午11:00:00
WEB文件备份ftp://219.141.188.8/web/201401271515/cninsure/Web/Web.Config
<?xml version="1.0"?><!-- 注意: 除了手动编辑此文件以外，您还可以使用 Web 管理工具来配置应用程序的设置。可以使用 Visual Studio 中的 “网站”->“Asp.Net 配置”选项。 设置和注释的完整列表在 machine.config.comments 中，该文件通常位于 \Windows\Microsoft.Net\Framework\v2.x\Config 中--><configuration> <configSections> <sectionGroup name="system.web.extensions" type="System.Web.Configuration.SystemWebExtensionsSectionGroup, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"> <sectionGroup name="scripting" type="System.Web.Configuration.ScriptingSectionGroup, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"> <section name="scriptResourceHandler" type="System.Web.Configuration.ScriptingScriptResourceHandlerSection, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplication"/> <sectionGroup name="webServices" type="System.Web.Configuration.ScriptingWebServicesSectionGroup, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"> <section name="jsonSerialization" type="System.Web.Configuration.ScriptingJsonSerializationSection, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="Everywhere"/> <section name="profileService" type="System.Web.Configuration.ScriptingProfileServiceSection, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplication"/> <section name="authenticationService" type="System.Web.Configuration.ScriptingAuthenticationServiceSection, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplication"/> </sectionGroup> </sectionGroup> </sectionGroup> </configSections> <appSettings> <add key="DAL" value="Whir.SQLServerDAL"/> <add key="Version" value="ezEIP2.0"/> <add key="VersionType" value="Asp.Net"/> <add key="SystemPath" value="http://www.cninsure.net/"/> <add key="PicServer" value="/System/Upload/"/> </appSettings> <connectionStrings> <add name="SQLConnString" connectionString="Data Source=.;Initial Catalog=FHInsurance;User ID=fhbx;Password=whjkfn63gxnwn5j" providerName="System.Data.SqlClient"/> </connectionStrings> <system.web> <pages> <controls> <add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> </controls> </pages> <!-- 设置 compilation debug="true" 将调试符号插入 已编译的页面中。但由于这会 影响性能，因此只在开发过程中将此值 设置为 true。 --> <compilation debug="false"> <assemblies> <add assembly="System.Design, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/> <add assembly="System.Web.Extensions.Design, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/> <add assembly="System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/> <add assembly="System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/> <add assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/> <add assembly="System.Xml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/> <add assembly="System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Management, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Messaging, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Configuration.Install, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> <add assembly="System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/></assemblies></compilation> <httpHandlers> <remove verb="*" path="*.asmx"/> <add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> <add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> <add verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="false"/> </httpHandlers> <httpModules> <add name="ScriptModule" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> </httpModules> <!-- 通过 <authentication> 节可以配置 ASP.NET 使用的 安全身份验证模式， 以标识传入的用户。 --> <authentication mode="Windows"/> <!-- 如果在执行请求的过程中出现未处理的错误， 则通过 <customErrors> 节可以配置相应的处理步骤。具体说来， 开发人员通过该节可以配置 要显示的 html 错误页 以代替错误堆栈跟踪。--> <customErrors mode="Off" defaultRedirect="GenericErrorPage.htm" /> <!-- 请不要修改 mode 的值(On)，如果为了调试修改为其他值，调试完毕之后请修改回来。 RemoteOnly <error statusCode="403" redirect="NoAccess.htm" /> <error statusCode="404" redirect="FileNotFound.htm" /> </customErrors> --> <httpRuntime executionTimeout="600" maxRequestLength="951200" useFullyQualifiedRedirectUrl="true" minFreeThreads="8" minLocalRequestFreeThreads="4" appRequestQueueLimit="100" enableVersionHeader="true"/> </system.web> <system.web.extensions> <scripting> <webServices> <!-- Uncomment this line to customize maxJsonLength and add a custom converter --> <!-- <jsonSerialization maxJsonLength="500"> <converters> <add name="ConvertMe" type="Acme.SubAcme.ConvertMeTypeConverter"/> </converters> </jsonSerialization> --> <!-- Uncomment this line to enable the authentication service. Include requireSSL="true" if appropriate. --> <!-- <authenticationService enabled="true" requireSSL = "true|false"/> --> <!-- Uncomment these lines to enable the profile service. To allow profile properties to be retrieved and modified in ASP.NET AJAX applications, you need to add each property name to the readAccessProperties and writeAccessProperties attributes. --> <!-- <profileService enabled="true" readAccessProperties="propertyname1,propertyname2" writeAccessProperties="propertyname1,propertyname2" /> --> </webServices> <!-- <scriptResourceHandler enableCompression="true" enableCaching="true" /> --> </scripting> </system.web.extensions> <system.webServer> <validation validateIntegratedModeConfiguration="false"/> <modules> <add name="ScriptModule" preCondition="integratedMode" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> </modules> <handlers> <remove name="WebServiceHandlerFactory-Integrated"/> <add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> <add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> <add name="ScriptResource" preCondition="integratedMode" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> </handlers> </system.webServer> </configuration>
控制
危害等级：中
漏洞Rank：10
确认时间：2016-04-20 15:12
非常感谢！
暂无
